Heralded qubit amplifiers for practical device-independent quantum key distribution 
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Device-independent quantum key distribution does not need a precise quantum mechanical model 
of employed devices to guarantee security. Despite of its beauty, it is still a very challenging exper- 
imental task. We compare a recent proposal by Gisin et al. [Phys. Rev. Lett. 105, 070501 (2010)] 
to close the detection loophole problem with that of a simpler quantum relay based on entanglement 
swapping with linear optics. Our full-mode analysis for both schemes confirms that, in contrast to 
recent beliefs, the second scheme can indeed provide a positive key rate which is even considerably 
higher than that of the first alternative. The resulting key rates and required detection efficiencies 
of approx. 95% for both schemes, however, strongly depend on the underlying security proof. 



Despite of its often praised unconditional security, 
quantum cryptography also relies on some assumptions. 
Some of them are quite natural, such as the validity of 
quantum mechanics, the existence of true random num- 
ber generators, or to assume that the legitimate users are 
well shielded from the eavesdropper. Other assumptions 
are more severe, like considering that the honest parties 
have an accurate and complete description of their physi- 
cal devices. Obviously, if the functioning of the real setup 
differs from that considered in the mathematical model, 
this may become completely vulnerable to new types of 
attacks not covered by the security proof [l|. 

In principle, this presumably hard-verifiable require- 
ment of characterizing real devices can be circum- 
vented using device-independent quantum key distribu- 
tion (diQKD) ■ Here, the legitimate users only need 
to specify a certain number of possible in- and outputs 
for each "black-box", and can prove the security of the 
protocol based on the violation of an appropriate Bell 
inequality, which certifies the presence of quantum corre- 
lations. In practice, however, diQKD is a very challeng- 
ing experimental problem. Specially, it is necessary to 
close the detection loophole which is present in all opti- 
cal tests of Bell's inequalities realized so far, even at short 
distances [B| . Current experimental non- locality tests use 
the so-called fair-sampling assumption to cope with the 
low efficiencies of both the quantum channel and detec- 
tors, but unfortunately this premise cannot be justified 
in a complete device independent scenario. 

In this Letter we investigate a potential solution to by- 
pass this detection loophole problem due to channel losses 
in diQKD in order to cover long distances. In particular, 
we compare a recent proposal by Gisin et al. [f| based 
on so-called qubit amplification, with that of a standard 
quantum relay which employs entanglement swapping. 
Contrary to recent arguments @, @] , our full- mode sim- 
ulation for both schemes demonstrates that the second 
alternative can indeed provide a positive key rate using 
only linear optical components. This key rate is also con- 



siderably higher than that of the first alternative. Let 
us stress that our main motivation lies on experimental 
realizations of diQKD over long distances, rather than 
presenting a rigorous full security proof for such schemes 
in the presence of losses. For that, we employ the secu- 
rity analysis provided in Ref. Q , which holds for specific 
kinds of eavesdropping attacks that are assumed, but un- 
proven, to be optimal. For comparison reasons, we also 
evaluate a conservative lower bound on the secret key 
generation rate that can be obtained by deterministic, or 
random assignment of inconclusive to conclusive events 
In this last scenario, however, the employed detec- 
tors must have almost perfect efficiency in order to dis- 
tribute a secret key with practical signals. These differ- 
ences should further emphasize the strong performance 
and requirements dependence of these schemes with re- 
spect to the underlying security analysis. 

As a starting point of our considerations let us recall 
the heralded qubit amplifier introduced by Gisin et al. 
in Ref. Q , extending an earlier work by Ralph and Lund 
The goal is to determine if an arriving light pulse 
contains precisely one photon or not, without disturb- 
ing its state of polarization. Such a scheme can be seen 
as a quantum-non-demolition measurement that distin- 
guishes single-photon signals from vacuum/multiphoton 
pulses. The basic setup is illustrated in Fig. [1] The am- 
plifier consists of a linear optics network, together with 
two single-photon sources, which are denoted in the figure 
as /Og ing i e and Pg ing i , emitting horizontal (h) and vertical 
(v) polarized photons respectively. Whenever a single- 
photon pulse from the channel enters the amplifier, its 
state of polarization is teleported to a photon situated 
at its output port. If the incoming light pulse is empty 
or contains more than one photon, however, the telepor- 
tation process fails with high probability. By looking at 
the detection pattern observed in the photodetectors Di, 
with i € {h, v}, Bob can verify which of these two possi- 
ble events occurred. 

Let us consider first for simplicity the scenario where 
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FIG. 1. Basic setup of a diQKD scheme with a quantum 
teleportation-based heralded qubit amplifier located on Bob's 
side [(J. The entanglement source pab is near Alice's trans- 
mitter. The parameter r\ c denotes the efficiency of optical 
couplers, t is the transmittance of a beamsplitter (BS), PBS 
stands for a polarizing BS, Ps inglc and Pg inglo represent two 
single-photon sources generating horizontal (h) and vertical 
(v) polarized photons respectively, R is a polarization rota- 
tor, and D and Di, with i G {h, v}, denote photodetectors. 
The single-photon sources p a in g ie can be realized, for instance, 
with heralded entanglement sources like spontaneous para- 
metric down-conversion (SPDC) sources. 



all optical elements within the amplifier are lossless, and 
all detectors Di are noiseless, have photon number reso- 
lution and perfect detection efficiency. Moreover, let us 
assume that Pg ing i e and Pg ingle emit exactly one photon 
each in the correct polarization, and 
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where |0) denotes the vacuum state, and b h (aj and 
bl) represent the creation operators for the horizontal 
(vertical) polarization modes, and < p < 1. In this sit- 
uation, it turns out that whenever Bob's detectors Di ob- 
serve two photons prepared in orthogonal polarizations, 
the unnormalized conditional state at the input ports of 
Alice's and Bob's measurement devices X and Y (see 
Fig. [JJ has the form (after an appropriate one-photon 
rotation R) 
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Here, t is the transmittance of a beamsplitter (BS) within 
the amplifier, and rj t denotes the transmission efficiency 
of the quantum channel. 

By selecting a sufficiently high value for the parame- 
ter t, Alice and Bob can always amplify the maximally 
entangled component of gab for any transmission effi- 
ciency of the quantum channel. This technique provides 
them with a powerful tool to overcome the problem of 
transmission losses in diQKD. Any successful amplifier 
event acts as a kind of fair-sampling device. Since the 
real measurement input is only chosen afterwards, there 



FIG. 2. Basic setup of a diQKD system with a standard 
quantum relay using linear optics. When compared to Fig. [TJ 
now the two single- phot on sources Psi ng i e and Psi ng i c , together 
with the BS of transmittance t, have been replaced by just 
one entanglement source Pbb' ■ 



should be no correlations between the trigger and the in- 
put choice As a result, it turns out that the overall 
detection efficiency which is needed to close the detec- 
tion loophole in diQKD can be reduced to basically that 
of Alice's and Bob's devices, but does not depend any- 
more on the loss of the quantum channel. A drawback of 
this technique is, however, the small success probability, 
^succ = (1 — t)[l — t — pr/ f (l — 2t)], of having a success- 
ful heralding signal from the amplifier for large t, which 
might strongly reduce the achievable secret key rate of 
the protocols. This imposes a trade-off on the value of 
the transmittance t. To guarantee that Alice and Bob 
share a high entangled state gab suitable for diQKD fa- 
vors t R3 1, but for small transmission efficiencies this 
implies an almost zero success probability. 

A more direct approach to implement a heralded qubit 
amplifier is to use a standard quantum relay with lin- 
ear optics. The basic setup is illustrated in Fig. [2] The 
working principle of this scheme is essentially the same as 
that of a teleportation-based amplifier. The only differ- 
ence between both solutions relies on Bob's mechanism 
to generate an entangled state in the amplifier for tele- 
portation. While in Ref. @ Bob mixes two-photon pulses 
with a vacuum signal at a BS whose transmittance is op- 
timized, in a quantum relay architecture he directly uses 
an entanglement photon source, which might be easier 
to realize experimentally. Intuitively speaking, one could 
expect that a linear optics quantum relay might be valu- 
able for long distance diQKD only when Alice and Bob 
have a high-quality entanglement source at their disposal. 
Otherwise, the conditional signals (tab shared by the le- 
gitimate users (after a successful amplifier event) might 
be poorly entangled. That is the case, for instance, when 
Pab and pbb> (see Fig. [2]) are generated with sponta- 
neous parametric down-conversion (SPDC) sources. We 
will show that this intuition is wrong, and a quantum re- 
lay can indeed be used to achieve considerable higher se- 
cret key rates than those obtained with the teleportation- 
based amplifier of Fig. [TJ even with practical signals. 
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Let us begin again by considering a simplified scenario 
where all detectors Di are noiseless, photon number re- 
solving and perfectly efficient. Moreover, we assume that 
r) t — 1 and the states pab = Pbb' have the form 
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with po + Pi + P2 = 1 • In this situation, it can be shown 
that whenever Bob's detectors Di observe precisely two 
photons prepared in orthogonal polarizations, the unnor- 
malized conditional quantum state shared with Alice is 
given by 
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In contrast to Eq. ([2]), there is no parameter now that 
Alice and Bob could tune to amplify further the maxi- 
mally entangled component of oab ■ Actually, depending 
on the probability distribution p n of the entanglement 
sources pab and Pbb', the fidelity of the outgoing state 
a ab with respect to a maximally entangled state could 
be very low. This occurs, for example, when Bob uses 
SPDC sources with a photon number distribution given 
by Pn = (n + 1)A"/(1 + A) n+2 , where A denotes a pa- 
rameter related to the pump amplitude of the laser. For 
small values of A, this fidelity is roughly equal to 1/2. 
The scenario changes if Alice and Bob post-select only 
those detection events where both of them see precisely 
one photon in their measurement devices X and Y. How- 
ever, such strategy seems to open the detection loophole. 
Note that the probability ^ cc that Alice and Bob obtain a 
conclusive result (i.e., both of them observe exactly one 
photon each in their measurement apparatuses) is also 
about 1/2 for small values of A. This result is far below 
the typical detection efficiency of 82.8% that is required 
to violate the Clauser-Hornc-Shimony-Holt (CHSH) in- 
equality (loj that prevents eavesdropping exploiting the 
detection loophole. This argumentation seems to render 
the conditional signal states oab given by Eq. (j4]) un- 
suitable for diQKD 0,0). 

The key point here, however, is simple, but counter- 
intuitive: the detection efficiency limit of 82.8% does 
not apply to the correlations observed when measuring 
the signals gab- This can be seen with a simple exam- 
ple. Suppose, for instance, that Alice and Bob employ 
a post-processing strategy where inconclusive outcomes 
are assigned to conclusive "+1" outcomes in a determin- 
istic fashion In this situation, the CHSH quantity 
becomes 
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where the parameter S cc denotes the CHSH value com- 
puted only on the set of conclusive results obtained before 



applying the post-processing step. For small A, we find 
that S is roughly given byS'=l + \/2>2. That is, Alice 
and Bob can indeed detect the presence of non-local cor- 
relations in the signals ab- This result mainly arises be- 
cause o ab provides Alice and Bob with an atypical detec- 
tion pattern: either both of them obtain a conclusive or 
an inconclusive outcome. But no conclusive-inconclusive 
or inconclusive-conclusive outcomes are observed, as typ- 
ically present for "local detection losses" . This argument 
actually holds for any value of p\ > in Eq. Q. When 
the detection efficiency of Alice's and Bob's detectors is 
not perfect (but high enough) , it turns out that the prob- 
ability to observe conclusive-inconclusive or inconclusive- 
conclusive results is very low, and they can still violate 
the CHSH inequality and distribute a secret key. 

To evaluate the performance of both setups in a more 
realistic situation, we perform a full-mode analysis for 
the case where Alice and Bob use both entangled and 
heralded single-photon sources based on SPDC, together 
with inefficient photon number resolving detectors. For 
simplicity, however, we do not consider any misalignment 
effect in the quantum channel or in Alice's and Bob's 
detection apparatuses (in view that photon loss is the 
dominant error mechanism), and we also neglect the ef- 
fect of dark counts in the photodetectors (which typi- 
cally results in a cut-off distance where the dark-count 
free key generation rate and the overall dark count prob- 
ability are roughly equal). To compute a lower bound 
on the secret key rate we employ the diQKD protocol 
based on the violation of the CHSH inequality analyzed 
111 Refs. di, [Tlj , and we evaluate two different secret key 
rate formulas. The first follows the security analysis pre- 
sented in Ref. @ and holds for particular eavesdropping 
attacks that are assumed to be optimal [l2| ■ The second 
one corresponds to the conservative situation where the 
legitimate users assign inconclusive to conclusive events 
in a deterministic fashion [4J. For the cases studied, this 
last strategy seems to perform better than that based on 
a purely random assignment of inconclusive to conclusive 
outcomes ■ The results are illustrated in Fig. [3] for a 
few values of the coupling efficiency r\ c and the detection 
efficiency fyjet of Alice's and Bob's detectors. In these 
simulations we consider only the contribution till four- 
photon pairs emitted by the SPDC sources. That is, we 
take p n = for all n > 5, which is reasonable when A 
satisfies A <C 1. For a given distance, we optimize the 
transmittance t and the intensities of the different lasers 
numerically to maximize the resulting key rate. When 
i] c and r/det are high enough, Fig. [3] shows that the use 
of a quantum relay can provide significantly higher key 
rates than a teleportation-based amplifier, while this last 
alternative can tolerate slightly lower detection efficien- 
cies (around 95%) than the former one (around 96%), 
though the achievable key rates in this regime are already 
quite low. The improved performance of the quantum 
relay in comparison with the amplifier scheme seems to 
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Security analysis of Ref. [7] 




40 60 80 
Fiber link [km] 

Deterministic assignment of inconclusive events 







1 






0.99 




■n«= 


0.98 




40 60 80 100 
Fiber link [km] 



FIG. 3. Lower bound on the secret key rate in logarithmic 
scale (base 10) vs. distance for a diQKD setup using the 
amplifier illustrated in Fig. Q] (dashed line), and the quantum 
relay with linear optics shown in Fig. [2] (solid line). The 
upper figure corresponds to the security analysis provided in 
Refs. [I, 0. The lower one represents the situation where 
the legitimate users assign inconclusive to conclusive results 
deterministically . In this last case, the minimum detection 
efficiency of Alice's and Bob's detectors is around 98% (for 
the teleportation-based amplifier) and 99% (for the quantum 
relay). In the simulations we assume rj c — rjact and the loss 
coefficient of the optical fiber a = 0.2 dB/km. 



rest mainly on the quality of the single-photon sources 
Psingie an d Psingic- Only if one considers the ideal sce- 
nario where these sources are perfect and on-demand, 
then the second scheme can deliver similar key rates as 
those of a quantum-relay with practical SPDC sources. 
However, when Bob uses heralded single-photon sources 
based on SPDC instead (see Fig. [3]), the small probability 
to find one photon in the idler mode of both sources at 
the same time strongly reduces the resulting key rate of a 
teleportation-based amplifier. Although less efficient, the 
use of threshold detectors might be also an alternative to 
photon number resolving detectors. However, the analy- 
sis of this scenario is more involved since the probability 
that Alice and Bob obtain conclusive/inconclusive events 
depends on the basis choice. Details of this analysis will 
be presented somewhere else. 

To conclude, we have performed a full-mode analy- 



sis of two potential solutions to circumvent the problem 
of transmission losses in diQKD using only linear opti- 
cal components. Contrary to recent findings, we have 
demonstrated that a standard quantum relay is indeed 
an alternative and can outperform a telcportation-based 
amplifier. Still, a main technological challenge here is to 
develop photodetectors with nearly perfect detection ef- 
ficiency and negligible noise. Recent results in this field 
give reasons to be optimistic 
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